Emit delete tombstone when provider_account_id changes (#1320)

The ClickHouse connected_accounts table is keyed by (project_id,
branch_id, user_id, provider, provider_account_id), so updating
providerAccountId in place on ProjectUserOAuthAccount orphaned the old
CH sort-key row: the sync re-emitted the row under the new key while the
old key sat untouched with no tombstone, and FINAL couldn't collapse
them. verify-data-integrity would then report a row count mismatch for
connected_accounts.

Record a delete tombstone for the old row state before the update runs,
so the sync pipeline marks the stale sort key as deleted.

<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved OAuth account update handling to ensure external database
synchronization is properly recorded when reassigning provider accounts
to different account IDs.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: BilalG1

apps/backend/src/app/api/latest/oauth-providers/crud.tsx

@@ -303,6 +303,14 @@ export const oauthProviderCrudHandlers = createLazyProxy(() => createCrudHandler
         });
       }
 
+      if (data.account_id !== undefined && data.account_id !== existingOAuthAccount.providerAccountId) {
+        await recordExternalDbSyncDeletion(tx, {
+          tableName: "ProjectUserOAuthAccount",
+          tenancyId: auth.tenancy.id,
+          oauthAccountId: params.provider_id,
+        });
+      }
+
       await tx.projectUserOAuthAccount.update({
         where: {
           tenancyId_id: {